@unito/integration-sdk/dist/src/eslint/rules/no-credentials-spread-in-cache-key.js

Integration SDK

const CACHE_FILE_RE = /\/src\/cache\.ts$/;
const CREDENTIALS_IDENTIFIER_RE = /^cred(|s|entials)$/;
const rule = {
    meta: {
        type: 'problem',
        docs: {
            description: 'Disallow spreading the entire `credentials` object into a cache-key hash input inside `cache.ts`',
            recommended: true,
        },
        schema: [],
        messages: {
            credentialsSpread: 'Do not spread `...{{name}}` into a cache-key hash input. Spreading the full credential makes every field (including rotating tokens) part of the cache key, causes cache thrash on token refresh, and surfaces credential material as a JSON string. Use a non-secret stable identifier instead, e.g. `credentials.unitoCredentialId` (throw if it is missing — never fall back to `accessToken`).',
        },
    },
    create(context) {
        const filename = context.filename ?? '';
        if (!CACHE_FILE_RE.test(filename)) {
            return {};
        }
        return {
            SpreadElement(node) {
                if (!node.argument || node.argument.type !== 'Identifier') {
                    return;
                }
                if (!CREDENTIALS_IDENTIFIER_RE.test(node.argument.name)) {
                    return;
                }
                context.report({
                    node,
                    messageId: 'credentialsSpread',
                    data: { name: node.argument.name },
                });
            },
        };
    },
};
export default rule;